The Stack Overflow podcast is back! Listen to an interview with our new CEO.
Search type Search syntax
Tags [tag]
Exact "words here"
Author user:1234
user:me (yours)
Score score:3 (3+)
score:0 (none)
Answers answers:3 (3+)
answers:0 (none)
isaccepted:yes
hasaccepted:no
inquestion:1234
Views views:250
Sections title:apples
body:"apples oranges"
URL url:"*.example.com"
Favorites infavorites:mine
infavorites:1234
Status closed:yes
duplicate:no
migrated:no
wiki:no
Types is:question
is:answer
Exclude -[tag]
-apples
For more details on advanced search visit our help page
Results tagged with Search options answers only user 6035

Strengthening themes, plugins and core installation to prevent intrusion.

3
votes
You could try hooking into template_include and showing the user a completely different page containing the login form (without changing the URL) if the post is password protected. Combine that WordP …
answered Jan 1 '13 by chrisguitarguy
15
votes
We have to look a bit deeper here to get an answer to your question. So, bloginfo is a simple wrapper around get_bloginfo. <?php function bloginfo( $show='' ) { echo get_bloginfo( $show, 'displa …
answered Jan 14 '13 by chrisguitarguy
40
votes
there's no benefit to moving wp-config outside the document root from a security perspective -- for the reasons above and these: You can restrict access to the file via your virtual host config or … . To me, moving wp-config out of the document root reeks of security by obscurity -- which is very much a straw man. …
answered Jul 18 '12 by chrisguitarguy
6
votes
> tags, where ever they choose. Is is a security risk? Only if you give folks you don't trust admin and/or editor roles. Or someone gains access to your an admin/editor account. Or there's another … security hole somewhere in the core that allows privilege escalation from a lower to higher user level (unlikely). By itself, it's not a security risk. Admin and editors need to be able to do things to actually manage the site. …
answered Jan 1 '13 by chrisguitarguy
1
vote
But how to know what is my WP namespace? namespacing a function, in WP land, just means prefixing it with something that makes it more unique and unlikely to conflict with anything else. Generall …
answered Oct 25 '15 by chrisguitarguy
1
vote
You should use a nonce to protect yourself from CSRF attacks. Even though you're not sending anything to the database, I'd suggest using some of the built in data validation functions (there is even …
answered Mar 10 '12 by chrisguitarguy
2
votes
should I install for a robust security infrastructure? Password-less SSH. And, since you're in control of the box you can have WordPress use bcrypt to hash passwords to make them slightly more secure … problems (whether it be performance or security breaches)? Take your pick. Look around. See what you need to monitor. There are uptime monitors, system performance monitoring solutions. Too broad …
answered Jan 9 '13 by chrisguitarguy